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BACKGROUND OF THE INVENTION 

* Field of the Invention 

5 

This invention relates to the field of data processing systems. More particularly, this 
invention relates to the field of the detection of computer viruses within computer files. 

Description of the Prior Art 

10 

It is known to provide anti-virus systems that are able to detect computer viruses 
within a computer file. A problem with such known anti-virus systems is that computer virus 
writers may seek to target the anti-vims system itself and exploit features of that anti-virus 
system in order to harm the computer system upon which the anti-virus system is running. As 

15 an example of this, it is known to produce files that are highly compressed versions of much 
larger files knowing that an anti- virus system will have to decompress the file in order that it 
can scan for viruses within it. If the decompressed file size is sufficiently large, then the 
amount of data requiring to be handled, even though it may contain very little information, 
may itself cause problems to an anti- virus system, e.g. it may exceed the amount of physical 

20 memory available requiring the extensive use of virtual memory thus significantly impacting 
the performance of the system conducting the anti- virus scan or in some cases even exceeding 
the amount of virtual memory available. 

It is known to provide anti-virus scanning systems that will time-out a virus scanning 
25 operation if the system clock indicates that a predetermined duration for that virus scanning 
operation has been exceeded. However, such an approach has the disadvantage that a slow or 
stressed/overloaded (possibly deliberately) computer system may inappropriately terminate a 
virus scanning operation using such a simple expired time approach. 

30 Measures that allow reliable breaks to be triggered during a virus scaiming operation 

whilst reducing their own vulnerabilities are strongly advantageous. 



SUMMARY OF THE INVENTION 
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Viewed from one aspect the present invention provides a method of detecting 
computer viruses within a computer file, said method comprising the steps of: 
^ receiving a request to scan a computer file for computer viruses; 

initiating a virus scanning operation upon said computer file; 
5 calculating during said virus scanning operation a measurement value indicative of an 

amount of data processing performed during said virus scanning operation; 

comparing during said virus scanning said measurement value with a threshold value; 

and 

triggering a break in said virus operation is said measurement value exceeds said 
10 threshold value. 

The invention operates by applying real time virus scanning operation metrics to the 
data processing being performed in order that this can be monitored and used to trigger 
appropriate breaks within the virus scanning operation. Using metrics associated with the 
15 amount of data processing performed provides a reliable way of resisting attacks on the anti- 
virus system by overloading it, whilst not exposing the system to vulnerabilities due to 
inappropriate breaks and possible early terminations of virus scanning operations that are not 
in themselves justified by an excessive amount of data processing being involved in the virus 
scanning operation. 

20 

Whilst the breaks triggered within the virus scanning operation could be used for 
various purposes, such as providing general feedback to a monitoring process, the invention is 
particularly useful in circumstances in which a break is used to perform a determination of 
whether the virus scanning operation should be terminated prior to completion. 

25 

One preferred technique for implementing the above is to monitor the size of the data 
processed during the data processing operation. If an excessive quantity of data is being 
processed during the vims scanning operation of a single computer file, then this indicates 
that it may be appropriate to terminate that virus scanning operation prior to its completion. 

30 

An additional degree of sophistication is provided when the size of the data processed 
in the virus scanning operation is compared with the size of the computer file being scanned 
when determining whether the amount of data being processed is excessive. It may be that a 
large computer file being scanned legitimately requires a large amount of data to be processed 
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_ during its scanning operation and accordingly should not be early terminated. Conversely, the 
type of highly compressed computer file deliberately intended to cause an overflow in the 
amount of data being processed would yield a much higher ratio in the amount of data being 
processed to the size of the computer file itself and so be distinguishable in a manner that its 
5 virus scanning may be properly early terminated. 

Another possibility in obtaining a measurement value indicative of an amount of data 
processing being performed is to associate a complexity value with each of a plurality of tests 
that are applied to the computer file to check for particular computer viruses within that 

10 computer file. Some tests may be relatively quick and simple therefore having a low 
complexity value. Conversely, tests checking for a polymorphic virus or requiring heuristic 
analysis may require a much greater amount of data processing to complete and accordingly 
have a high complexity value. Summing the complexity values of the tests applied to a 
computer file and then comparing this with a threshold to trigger a break is a reliable way of 

15 regularly triggering breaks in a manner properly related to the amount of data processing 
being performed as discussed above. 

Viewed ft-om another aspect the present invention provides apparatus for detecting 
computer viruses within a computer file, said apparatus comprising: 
20 a receiver operable to receive a request to scan a computer file for computer viruses; 

initiating logic operable to initiate a vims scanning operation upon said computer file; 

calculating logic operable to calculate during said virus scanning operation a 
measurement value indicative of an amount of data processing performed during said virus 
scanning operation; 

25 comparing logic operable during said virus scanning to compare said measurement 

value with a threshold value; and 

triggering logic operable to trigger a break in said virus operation is said measurement 
value exceeds said threshold value. 

30 Viewed fi-om a fiirther aspect the invention provides a computer program product 

carrying a computer program for controlling a computer to detect computer viruses within a 
computer file, said computer program comprising: 

receiver code operable to receive a request to scan a computer file for computer 
viruses; 
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initiating code operable to initiate a virus scanning operation upon said computer file; 

calculating code operable to calculate during said virus scanning operation a 
measurement value indicative of an amount of data processing performed during said virus 
scanning operation; 

comparing code operable during said virus scanning to compare said measurement 
value vv'ith a threshold value; and 

triggering code operable to trigger a break in said virus operation is said measurement 
value exceeds said threshold value. 

The above, and other objects, features and advantages of this invention will be apparent 
from the following detailed description of illustrative embodiments which is to be read in 
connection with the accompanjdng drawings. 

BRIEF DESCRIPTION OF THE DRAWINGS 

Figure 1 schematically illustrates an on-access anti-virus file scanning system; 

Figure 2 schematically illustrates the decompression of a computer file prior to scanning 
and the subsequent monitoring of the size of data processed; 

Figure 3 is a flow diagram illustrating the operation of the system in accordance with 
Figure 2; 

Figure 4 is a flow diagram illustrating an example of a determination of whether or not to 
early terminate a virus scanning operation based upon the size of data processed; 

Figure 5 schematically illustrates a computer file being virus scanned and breaks 
provided within that operation based upon a sum of complexity values of applied tests; 

Figure 6 is a flow diagram illustrating the operation of the system in accordance with 
Figure 5; 

Figure 7 is a flow diagram illustrating a determination of whether or not scanning should 
be early terminated in accordance with the system of Figure 6; and 
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Figure 8 is a schematic representation of a general purpose computer system for 
performing the techniques described above; 

DESCRIPTION OF THE PREFERRED EMBODIMENTS 

Figure 1 illustrates an on-access anti-virus system. A scan requesting process 2, 
which may be an application program interacting with a user via a display 4 and a keyboard 6, 
issues an access request to an operating system file system 8. This operating system file 
system 8, prior to servicing the access request from an associated hard disk drive 10, 
generates a scan request that is passed to an anti-virus system 12 together with the file 
concerned and further associated data. Within the anti-virus system 12, an anti-virus engine 
14 working with virus definition data 16 serves to apply a plurality of tests for different 
known viruses and virus like behaviour to the computer file in order to detect the presence of 
a computer virus within that computer file. A pass or fail signal is passed back to the 
operating system file system 8 and used to determine whether or not the access request via the 
scan requesting process 2 is serviced. 

Figure 2 illustrates virus scanning operation when access is made to a compressed 
computer file 18. In order that this compressed computer file 18 can be properly checked it is 
decompressed into an uncompressed file form 20 and then a sequence of tests corresponding 
to separate DAT driver files within the virus definition data 16 are applied to the 
uncompressed data. In practice the anti-virus system 12 requests a portion of the compressed 
file 18 to be decompressed and then appUes the tests to that decompressed portion. If fiirther 
portions still requiring checking, then more of the compressed file is decompressed and 
checked. 

As illustrated in Figure 2, the different tests applied corresponding to different DAT 
drivers have different associated times taken for their completion. They also require differing 
amounts of data to be processed, e.g. differing amounts of data to be written to and read from 
memory or non-volatile storage. During the virus scanning operation, a tally is kept of the 
size of the data that has been processed so far in the virus scanning operation and when this 
exceeds a threshold level, a break in the virus scanning operation is triggered and a check is 
made as to whether or not the virus scanning operation should continue. 
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Figure 3 is a flow diagram illustrating the operation of Figure 2. At step 20, a scan 
request is received by the anti- virus system 12. At step 22, a portion of the computer file to 
be scanned is selected for initial processing. 

5 

At step 24, a determination is made as to whether or not the portion of data recovered 
from the computer file being scanned requires decompressing or unpacking prior to testing. If 
the data does require decompressing or unpacking, then this is performed at step 26. Step 28 
updates a data process counter to take account of the decompressing or unpacking operation 
10 of step 26, and step 30 then compares this data processed counter value with a threshold value 
to see if it has been exceeded. 

If the threshold has been exceeded, then processing proceeds to step 32 at which a 
determination is made as to whether or not the virus scanning operation should continue. If 
15 the virus scanning operation is not to continue, then it is terminated. If the virus scanning 
operation is to continue, then the data processed counter used to trigger the breaks within the 
virus scanning operation is reset at step 34 and processing is returned to step 36. 

Step 36 selects the first DAT driver (i.e. computer virus test) to be applied to the 
20 portion of the computer file being processed. Step 24, if it determines that no decompression 
or unpacking is required, passes control directly to step 36. 

Step 38 applies the selected test to the portion of the computer file being processed 
and step 40 then updates the counter of the amount of data processed in a similar manner to 
25 step 28. 

Step 42 determines whether or not a threshold amount of data processed has been 
exceeded and if so passes processing to step 44 at which a determination is made as to 
whether or not to continue the virus scanning operation. If the virus scanning operation is not 
30 to continue, then the virus scanning operation is terminated. If virus scanning is to continue, 
then processing proceeds to step 46 at which the data processed size counter (break initiating 
counter) is reset and processing is returned to step 48. If the threshold value tested in step 42 
was not exceeded, then step 42 passes control directly to step 48. 
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At step 48 a determination is made as to whether or not any more tests need to be 
apphed to the portion of the computer file currently under test. If more tests are needed, then 
the next of these is selected at step 50. If no more tests are needed for that portion of the 
computer file, then processing proceeds to step 52 at which a determination is made as to 
5 whether or not any further portions of the computer file under test need to be scanned for 
computer viruses. If no further portions of the computer file under test do need to be scanned, 
then processing terminates. If further portions of the computer file under test do need to be 
subject to computer virus scanning, then processing returns to step 22 at which the next 
portion of the computer file for testing is selected. 

iO 

Figure 4 is a flow diagram illustrating the type of processing that may be performed in 
steps 32 or 44 of Figure 3 in determining whether or not processing should be continued or 
early terminated. At step 54 a total size value for the complete amoimt of data processed so 
far in analysing the computer program under test (as compared to the amount of data that 

15 triggered the break) is updated. At step 56, a ratio of this total data processed so far compared 
to the file size of the computer file being scanned is calculated. The calculated ratio is 
compared with a threshold ratio value at step 58 and if the threshold ratio value is exceeded, 
then the result of the determination is to stop the scan at step 60. Conversely, if the threshold 
ratio is not exceeded at step 58, then step 62 sets the result of the determination to be to 

20 continue the scan operation. 

Figure 5 schematically illustrates an alternative embodiment of the invention in which 
a complexity value scoring scheme is used to trigger breaks within the scanning operation. A 
computer file 64 to be virus scanned is in this case in its native form and does not require 
25 decompressing or unpacking. It will be appreciated that the complexity scoring approach 
could also work with compressed or packed files in providing a break triggering mechanism. 

A portion of the computer file 64 to be tested is then subject to the processing 
associated with a series of DAT drivers within the computer virus definition data 16 of the 
30 anti-virus system 12. Each of the DAT drivers (tests) has an associated complexity value (e.g. 
a simple test could have a complexity value of 1 whilst a complicated heuristic test could have 
a complexity value of 10). The complexity values represent the amount of data processing 
typically required to conduct that test. A running count/tally of the total of the complexity 
values for the tests applied up to that point is kept and when this exceeds a threshold value a 
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,break in the virus scanning operation is triggered and a determination made as to whether or 
^ not virus scanning operation should proceed further. 

Figure 6 is a flow diagram illustrating the operation of the system of Figure 5 in which 
5 the decompression and unpacking processes have been removed. At step 66, a request to scan 
a computer file is received. Step 68 selects the first DAT driver to be applied to a first portion 
of the computer file 64. At step 70 the DAT driver selected is applied. At step 72 a 
complexity counter value is updated to reflect the total of the complexity values of the DAT 
driver tests applied up to that point. Step 74 tests whether the complexity value counter has 

10 exceeded a threshold value. If the threshold value has been exceeded, then step 76 determines 
whether or not the virus scanning operation should continue. If the virus scanning operation 
should not continue, then it is terminated. If the virus scanning operation should continue, 
then the break triggering counter is reset at step 78 and processing returned to step 80. If the 
threshold value tested at step 74 was not exceeded, then processing proceeds directly from 

15 step 74 to step 80. 

Step 80 determines whether or not more DAT drivers should be apphed to the portion 
of the computer file under test. If more DAT drivers are to be appUed, then the next of these 
is selected at step 82 and processing is returned to step 70. If no more DAT drivers are to be 
20 applied then processing of that portion of the computer file concerned is terminated. 

It will be appreciated that a further portion of the computer file may be selected for 
testing in accordance with the above technique as described in relation to the first example 
embodiment. In many practical instances, it is found that only a first portion of a computer 
25 file will in fact requiring testing. 

Figure 7 illustrates an example of the processing that may be involved in the 
determination of step 76. At step 84, an update is made to a counter recording the total 
complexity of all the DAT drivers applied to the computer file under test (not just those since 
30 the last break was triggered). Step 86 then compares this total complexity value with a 
termination threshold value. If the termination threshold value is exceeded, then the result of 
the test of step 76 is set to stop by step 88. Conversely, if the threshold value is not exceeded 
then the determination of step 76 is set to continue by step 90. 
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Figure 8 schematically illustrates a general purpose computer system 92 of the type 
that may be used to implement the data processing described above. The general purpose 
computer 92 includes a central processing unit 94, a read only memory 96, a random access 
memory 98, a hard disk drive 100, a display driver 102 and a display 104, a user input/output 
unit 106 and a keyboard 108 and a mouse 110 and a network link unit 112 all linked by a 
common bus 114. The central processing unit 94 executes computer program instructions to 
provide computer code portions yielding the processing operations described above. The 
computer program instructions may be stored within one or more of the read only memory 96, 
the random access memory 98 or the hard disk drive 100. The computer program instructions 
may also be downloaded into the general purpose computer 92 via the network link unit 1 12. 
The computer program may be embodied as a computer program product distributed via a 
recording medium, such as a compact disk or a floppy disk drive, or may be downloaded from 
a remote source via a network link. 

Although illustrative embodiments of the invention have been described in detail herein 
with reference to the accompanying drawings, it is to be understood that the invention is not 
limited to those precise embodiments, and that various changes and modifications can be 
effected therein by one skilled in the art without departing from the scope and spirit of the 
invention as defined by the appended claims. 
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WE CLAIM: 

1. A method of detecting computer viruses within a computer file, said method 
comprising the steps of: 

5 receiving a request to scan a computer file for computer viruses; 

initiating a virus scanning operation upon said computer file; 

calculating during said virus scanning operation a measurement value indicative of an 
amount of data processing performed during said virus scanning operation; 

comparing during said virus scanning said measurement value with a threshold value; 

10 and 

triggering a break in said virus operation is said measurement value exceeds said 
threshold value. 

2. A method as claimed in claim 1, further comprising the step of, upon occurrence of 
15 said break, determining using said measurement value whether or not said virus scanning 

operation should be terminated prior to completion. 

3. A method as claimed in claim 1, wherein said measurement value yields a processed 
data size value for data processed during said virus scanning operation. 

20 

4. A method as claimed in claim 1, wherein said amount of data processing performed 
includes data processing involved in any decompression of said computer file required for 
said virus scanning operation. 

25 5. A method as claimed in claim 1, wherein said amount of data processing performed 
includes data processing involved in any unpacking of said computer file required for said 
virus scanning operation. 

6. A method as claimed in claim 2, wherein said measurement value yields a processed 
30 data size value for data processed during said virus scanning operation and step of 
determining is responsive to both said processed data size value and a computer file size value 
for said computer file when determining whether or not said virus scanning operation should 
be terminated prior to complefion. 
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7. A method as claimed in claim 6, wherein said step of determining calculates a 
measurement ratio of said processed data size value to said computer file size value and 
compares this with a termination size threshold ratio such that said virus scanning is 
terminated if said measurement ratio exceeds said termination size threshold ratio. 

5 

8. A method as claimed in claim 1, wherein said virus scanning operation apphes a 
plurahty of tests to said computer file, each test having an complexity value indicative of an 
amount of data processing associated with that test and said measurement value is a sum of 
complexity values for tests applied during said virus scanning operation. 

10 

9. A method as claimed in claim 8, wherein said plurality of test applied are selected in 
dependence upon said computer file. 

10. A method as claimed in claim 2, wherein said virus scanning operation applies a 
15 plurality of tests to said computer file, each test having an complexity value indicative of an 

amount of data processing associated with that test, said measurement value being a sum of 
complexity values for tests applied during said virus scanning operation and said step of 
determining terminating said virus scanning operation prior to completion if said sum of 
complexity values exceeds a termination complexity threshold value. 

20 

11. Apparatus for detecting computer viruses within a computer file, said apparatus 
comprising; 

a receiver operable to receive a request to scan a computer file for computer viruses; 

initiating logic operable to initiate a virus scanning operation upon said computer file; 
25 calculating logic operable to calculate during said virus scanning operation a 

measurement value indicative of an amount of data processing performed during said virus 
scanning operation; 

comparing logic operable during said virus scanning to compare said measurement 
value with a threshold value; and 
30 triggering logic operable to trigger a break in said virus operation is said measurement 

value exceeds said threshold value. 
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,12. Apparatus as claimed in claim 11, wherein, upon occurrence of said break, 
determining logic operates using said measurement value to determine whether or not said 
virus scanning operation should be terminated prior to completion. 

5 13. Apparatus as claimed in claim 12, wherein said measurement value yields a processed 
data size value for data processed during said virus scanning operation. 

14. Apparatus as claimed in claim 11, wherein said amount of data processing performed 
includes data processing involved in any decompression of said computer file required for 

10 said virus scaiming operation. 

15. Apparatus as claimed in claim 11, wherein said amount of data processing performed 
includes data processing involved in any unpacking of said computer file required for said 
virus scanning operation. 

15 

16. Apparatus as claimed in claim 12, wherein said measurement value yields a processed 
data size value for data processed during said virus scanning operation and said determining 
logic is responsive to both said processed data size value and a computer file size value for 
said computer file when determining whether or not said virus scanning operation should be 

20 terminated prior to completion. 

17. Apparatus as claimed in claim 16, wherein said determining logic is operable to 
calculate a measurement ratio of said processed data size value to said computer file size 
value and compare this with a termination size threshold ratio such that said virus scanning is 

25 terminated if said measurement ratio exceeds said termination size threshold ratio. 

18. Apparatus as claimed in claim 11, wherein said virus scanning operation appHes a 
plurality of tests to said computer file, each test having an complexity value indicative of an 
amount of data processing associated with that test and said measurement value is a sum of 

30 complexity values for tests applied during said virus scanning operation. 



19. Apparatus as claimed in claim 18, wherein said plurality of test applied are selected in 
dependence upon said computer file. 
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.20. Apparatus as claimed in claim 12, wherein said virus scanning operation applies a 
plurality of tests to said computer file, each test having an complexity value indicative of an 
amount of data processing associated with that test, said measurement value being a sum of 
complexity values for tests applied during said virus scanning operation and said step of 
5 determining terminating said virus scanning operation prior to completion if said sum of 
complexity values exceeds a termination complexity threshold value. 

21 . A computer program product carrying a computer program for controlling a computer 
to detect computer viruses within a computer file, said computer program comprising: 

10 receiver code operable to receive a request to scan a computer file for computer 

viruses; 

initiating code operable to initiate a virus scanning operation upon said computer file; 

calculating code operable to calculate during said virus scanning operation a 
measurement value indicative of an amount of data processing performed during said virus 
15 scanning operation; 

comparing code operable during said virus scanning to compare said measurement 
value with a threshold value; and 

triggering code operable to trigger a break in said virus operation is said measiuement 
value exceeds said threshold value. 

20 

22. A computer program product as claimed in claim 21, wherein, upon occurrence of said 
break, determining code operates using said measurement value to determine whether or not 
said virus scanning operation should be terminated prior to completion. 

25 23. A computer program product as claimed in claim 22, wherein said measurement value 
yields a processed data size value for data processed during said virus scanning operation. 

24. A computer program product as claimed in claim 21, wherein said amount of data 
processing performed includes data processing involved in any decompression of said 

30 computer file required for said virus scanning operation. 

25. A computer program product as claimed in claim 21, wherein said amount of data 
processing performed includes data processing involved in any unpacking of said computer 
file required for said virus seaming operation. 
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26. A computer program product as claimed in claim 22, wherein said measurement value 
yields a processed data size value for data processed during said virus scanning operation and 
said determining code is responsive to both said processed data size value and a computer file 

5 size value for said computer file when determining whether or not said virus scannmg 
operation should be terminated prior to completion. 

27. A computer program product as claimed in claim 26, wherein said determining code is 
operable to calculate a measurement ratio of said processed data size value to said computer 

10 file size value and compare this with a termination size threshold ratio such that said virus 
scanning is terminated if said measurement ratio exceeds said termination size threshold ratio. 



I 28. A computer program product as claimed in claim 21, wherein said virus scanning 
operation applies a plurality of tests to said computer file, each test having an complexity 
15 value indicative of an amount of data processing associated with that test and said 
measurement value is a sum of complexity values for tests applied during said virus scanning 
operation. 

29. A computer program product as claimed in claim 28, wherein said pluraHty of test 
20 applied are selected in dependence upon said computer file. 

30. A computer program product as claimed in claim 22, wherein said virus scanning 
operation applies a plurality of tests to said computer file, each test having an complexity 
value indicative of an amount of data processing associated with that test, said measurement 

25 value being a sum of complexity values for tests applied during said virus scanning operation 
and said step of determining terminating said virus scanning operation prior to completion if 
said sum of complexity values exceeds a termination complexity threshold value. 
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ABSTRACT OF THE DISCLOSURE 
PROVIDING BREAK POINTS IN VIRUS SCANNING OPERATION 

A computer virus scanning system is described in which during the scanning operation 
5 a measurement value indicative of the amount of data processing performed is calculated and 
this measurement value used to trigger breaks in the virus scanning operation. The triggered 
breaks can be used to perform a determination as to whether or not the virus scanning 
operations should be early terminated. One possibihty is to measure the total size of the data 
processed during the virus scanning operation and calculate a ratio of this compared to the 
10 size of the computer file being virus scanned. If this calculated ratio exceeds a predetermined 
threshold, then virus scanning may be terminated. Another possibility is to associate a 
complexity value with each of a plurality of tests applied in the virus scanning operation. A 
total for these complexity values may be used to trigger the breaks and also to trigger early 
termination upon exceeding of respective threshold levels. 



[Figure 3] 
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As below named inventors, we declare that the information given herein is true, that we 
believe that we are joint inventors of the invention entitled: 

Providing Break Points in Virus Scanning Operation 

which is described and claimed in: 

[X] the attached specification, or 

[ ] the specification in application Serial No. , filed ; 

(for declaration not accompanying application) 

that we do not know and do not believe that the same was ever known or used in the 
United States of America before our invention thereof or patented or described in any 
printed publication in any country before our invention thereof, or more than one year prior 
to this application, or in public use or on sale in the United States of America more than one 
year prior to this application, that the invention has not been patented or made the subject 
of an inventor's certificate issued before the date of this application in any country fojeign to 
the United States of America on an application filed by us or our legal representatives or 
assigns more than twelve months prior to this application, that we acknowledge our duty to 
disclose information of which we are aware which is material to patentability in accordance 
with 37 CFR 31 .56. We hereby state that we have reviewed and understand the contents of 
the above- id entitled specification, including the claims, as amended by any amendment 
referred to above. We hereby claim the priority benefits under 35 U.S.C.3119 of any 
application(s) for patent or inventor's certificate listed below. All foreign applications for 
patent or inventor's certificate on this invention filed by us or our legal representatives or 
assigns prior to the application(s) of which priority is claimed are dso identified below. 



PRIOR APPLICATiON(S), IF ANY, OF WHICH PRIORITY IS CLAIMED 



COUNTRY APPLICATION NO. DATE OF FILING 



ALL FOREIGN APPLICATIONS, IF ANY. FILED PRIOR 



TO THE APPLICATION(S) OF WHICH PRIORITY IS CLAIMED 



COUNTRY APPLICATION NO. DATE OF FILING 



POWER OF ATTORNEY: 

As named inventors, we hereby appoint the following attorney(s) and/or agents(s) to 
prosecute this application and transact all business in the Patent and Trademarl^ office 
connected therewith: Gordon D. Coplein #19,165, William F. Dudine, Jr. #20,569, Michael 
J. Sweedler #19,937, 8. Peter Ludwig #25,351, Paul Fields #20,298, Marc S. Gross 
#19,614, Joseph B. Lerch #26,936, Melvin C. Garner #26,272, Ethan Horwitz #27,646, 
Beverly B. Goodwin #28,41 7, Adda C. Gogoris #29,714, Martin E. Goldstein #20,869, Bert 
J. Lewen #19,407, Henry Sternberg #22,408, Peter C. Schechter#31,662, Robert Schaffer 
#31,194, Robert C. Sullivan, Jr. #30,499, Ira J. Levy #35587, Joseph R. Robinson #33,448, 
Scott G. Lindvall #40,325 

all of the firm of DARBY & DARBY P.C., 805 Third Avenue, New York, NY 10022 

SEND CORRESPONDENCE TO: DIRECT TELEPHONE CALLS TO: 

DARBY & DARBY P.C. 
805 Third Avenue 

New York, NY 10022 212-527-7700 



FULL NAME AND RESIDENCE OF INVENTOR 1 



LAST NAME: 
FIRST NAME: 
MIDDLE NAME: 
CITY: 

STATE OR FOREIGN COUNTRY: 
COUNTRY OF CITIZENSHIP: 
POST OFFICE ADDRESS: 
CITY: 

STATE OR COUNTRY: 
ZIP CODE: 



LUCAS 
MARTIN 
JAMES 
Aylesbury 
United Kingdom 
United Kingdonn 
25 Thackeray End 
Aylesbury 
United Kingdom 
HP19 8JE 



FULL NAME AND RESIDENCE OF INVENTOR 2 



LAST NAME: 
FIRST NAME: 
MIDDLE NAME: 
CITY: 

STATE OR FOREIGN COUNTRY: 
COUNTRY OF CITIZENSHIP: 
POST OFFICE ADDRESS: 
CITY: 

STATE OR COUNTRY: 
ZIP CODE: 



WOLFF 
DANIEL 
JOSEPH 
Aylesbury 



United Kingdom 
United Kingdom 
35 Castle Street 
Aylesbury 
United Kingdom 
HP20 2RA 



We further declare that all statements made herein of our own knowledge are true and lhat 
all statements made on information and belief are believed to be true; and further that these 
statements were made with the knowledge that willful false statements and the like so 
made are punishable by fine or imprisonment, or both, under Section 1001 of Title 18 of the 
United States Code, and that such willful false statements may jeopadize the validity of the 
application or any patent issuing thereon. 



SIGNATURE OF INVENTOR 1: HU-<^ DATED: e,^p+ lifyoo 



SIGNATURE OF INVENTOR 2: 




DATED: 'l£? "IfX^ 



